Automated Inspection and CVE Scanning for Antiy IEP EPP

SSH Connection and Inspection

The first hurdle of the inspection is not on the remote side but local: your Windows workstation has no handy SSH automation tool at all. AVL Code does not connect right away — it does two things first.

Now I need you to SSH into <intranet IP>, username root, password <credential>.
Under /root, run the command cd /data0/app_new/&&LD_LIBRARY_PATH=./env/posix/lib7/ python /root/data_capture_safety.pyc to inspect the Antiy IEP EPP product

Parses the composite instruction into 4 subtasks: SSH inspection → service check → vulnerability scan → report generation
→ Probes the local environment: Python / paramiko ready · no sshpass/plink on Windows → switches to paramiko for the connection
→ SSH connection succeeds (root) → runs the inspection command, captures the output
→ Reads the inspection result inspection.json

Service State Collection

inspection.json is only half the inspection; the other half is "which services are alive". The output of this step directly determines the service overview and risk level in the report.

Run the command /data0/bin/status_supervisorctl.sh to check the service status of Antiy IEP EPP;
Write the contents of the generated inspection.json, the service status and the vulnerability results into an inspection report

Runs status_supervisorctl.sh → 46 services: 44 running · 2 stopped · no task-queue backlog
→ Collects system info: CentOS 7 (EOL) · CPU 0.90% · memory 67% · disk 11%
→ Automatically converts the Chinese encoding of inspection.json
→ Key findings: license expires 2026-06-24 (1 day left) · 1/1 client offline

Vulnerability Scan

The vulnerability scan is the step most likely to stall: intelligence sources may time out and tools may refuse your request. Here you watch the degradation strategy carry the scan through anyway.

Call cve-mcp-server to run a vulnerability scan on <intranet IP>.

Calls cve-mcp-server: the IP reputation query is refused (private IP) → falls back to vulnerability enumeration based on OS version + package list
→ NVD API times out repeatedly → the scan completes along the degradation chain
→ Fuses NVD / CISA KEV / OSV.dev / EPSS multi-source intelligence to compute risk scores
→ Finds the kernel vulnerability CVE-2017-5972 (CVSS 7.5): SYN cookie DoS risk

Report Generation and Correction

A compliance report has two hard floors: the styling must be proper and no sensitive data may leak. Here you get the report — and watch it get fixed with one sentence.

Write the inspection results and vulnerability results into an HTML inspection report styled after "NetAdmin_工具兼容性报告". The serial numbers and passwords in the report are sensitive information and must be replaced with asterisks.
──Round 2──
The [virus database version] status should be [abnormal]; add a line below: the virus database has not been updated for over a month — upgrade it recommended. Upgrade package download URL: https://iepupdate.antiy.cn/update_list/GettoollistforZip

Reads the reference report’s HTML structure and reuses its style framework
→ Serial numbers replaced with ****, passwords masked
→ Generates the Antiy IEP EPP inspection report: system info / license (redacted) / 46 service states / vulnerability results / risk summary / recommended measures
→ On receiving the correction, applies an incremental fs.patch (no full rewrite): virus-database status re-judged [abnormal] + a new upgrade hint line with the download URL

Try it yourself

Run it yourself: swap the placeholders for your host info; the step order matches this article.

python --version

python -c "import paramiko"

cd /data0/app_new/ && LD_LIBRARY_PATH=./env/posix/lib7/ python /root/data_capture_safety.pyc

/data0/bin/status_supervisorctl.sh

check_ip_reputation <intranet IP>

check_package_vulns <OS version> <package list>

scan_dependencies <package inventory>

lookup_cve <CVE id>

fs.patch <report path> <edit content>

• Step 1: environment probe (local).
• Step 2: SSH connection and inspection (via a paramiko script when the Windows machine has no sshpass/plink).
• Step 3: service status check.
• Step 4: vulnerability scan (cve-mcp-server tools, following the degradation chain on timeouts / private IPs).
• Step 5: incremental report correction (no full HTML rewrite).
• The session export does not include per-call tool details, so the degradation chain and tool names along the way (paramiko, check_ip_reputation, fs.patch, etc.) follow the case report’s record. Also
• note: the first user message in the session.html export is a condensed version ("you know the password"); the full composite instruction quoted here follows the case report’s "user instruction (original input)", and the difference between the two versions is preserved as-is. All intranet IPs and credentials are replaced with placeholders in this article.

Next question: The report says "the license expires tomorrow" — once "renew the license immediately" is on the ticket, can next quarter’s inspection reuse the script to batch-run across multiple hosts?